WardtermSSH client
EN
Download

"sign_and_send_pubkey: no mutual signature supported": how to fix it

Your SSH client and the server share no signature algorithm for this key. It nearly always means an RSA key and an old server that only knows SHA-1 signatures (ssh-rsa), which OpenSSH clients have refused by default since 8.8. The key itself is fine. Use an Ed25519 key on that server if it supports one, upgrade the server, or allow ssh-rsa for that one host with PubkeyAcceptedAlgorithms +ssh-rsa.

Updated . Reproduced with OpenSSH 10.3 on macOS and OpenSSH 10.0 on Debian 13 as clients against a real OpenSSH 6.6 server on Ubuntu 14.04, with a throwaway key.

What you see

sign_and_send_pubkey: no mutual signature supported
user@server: Permission denied (publickey,password).

Often the visible output is only the second line. In our tests the first line appeared for an older format RSA key file with no .pub file next to it. With a .pub file, the same failure was silent, and only ssh -v showed the reason:

debug1: send_pubkey_test: no mutual signature algorithm

Creating the .pub file removes the first line but does not fix the login.

Why it happens

The name ssh-rsa refers to two things: a key type and a signature using SHA-1. An RSA key can also sign with SHA-256 or SHA-512, known as rsa-sha2-256 and rsa-sha2-512. OpenSSH has supported those since 7.2. OpenSSH 8.8 stopped offering the SHA-1 signature by default, because SHA-1 is broken.

So a server older than 7.2, or an appliance with an old SSH library, can accept only the signature your client will no longer make. A modern server is not affected, and you do not need to replace an RSA key because of this: the same key logged in fine to a modern server in our tests.

Confirm it

ssh -v user@server true 2>&1 | grep -E 'remote software version|mutual|server-sig-algs'

A match looks like this. An old server version and no server-sig-algs line:

debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13
debug1: send_pubkey_test: no mutual signature algorithm

To confirm, try it for one connection:

ssh -o PubkeyAcceptedAlgorithms=+ssh-rsa user@server

If this logs in, that is the cause. Clients older than OpenSSH 8.5 call this option PubkeyAcceptedKeyTypes.

Fix 1: use an Ed25519 key

This is the best fix if the server supports it, which means OpenSSH 6.5 or later. It worked against the 6.6 server in our test with no special options, and needs no SHA-1.

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_oldserver
ssh-copy-id -o PubkeyAcceptedAlgorithms=+ssh-rsa -i ~/.ssh/id_ed25519_oldserver.pub user@server

See how to generate an ed25519 key. ECDSA works too where Ed25519 is not available. To compare the two key types, see RSA vs Ed25519.

Fix 2: allow ssh-rsa for that one host

Use this for a device you cannot change, such as old network gear. Keep it to the one host in ~/.ssh/config instead of adding it under Host *:

Host old-box
  HostName 203.0.113.10
  User user
  IdentityFile ~/.ssh/id_rsa
  IdentitiesOnly yes
  PubkeyAcceptedAlgorithms +ssh-rsa

OpenSSH describes this as a stopgap until the old system can be upgraded. If the device only has an RSA host key, you get a different error about the host key type. Add HostKeyAlgorithms +ssh-rsa to the same block, and see no matching key exchange for that family of errors.

Fix 3: upgrade the server

A server on OpenSSH 7.2 or later signs with SHA-2 automatically and the message goes away. A server this old is also missing years of security fixes.

If it still fails on Red Hat style systems

On RHEL 9 and its relatives, the system's crypto policy restricts SHA-1 signatures by default, on top of the OpenSSH setting:

update-crypto-policies --show

If you must reach the old server from that machine, allow SHA-1 signatures again with the SHA1 subpolicy, then restart:

sudo update-crypto-policies --set DEFAULT:SHA1

This affects the whole machine and every program on it, so prefer fix 1 where you can.

The reverse case

An old client against a new server fails the other way round: the client offers ssh-rsa and the server refuses it. The client just sees Permission denied (publickey). Upgrade the client or use an Ed25519 key.

Questions

Do I need to replace my RSA key?

No. The same RSA key signs with rsa-sha2-256 or rsa-sha2-512 on any server running OpenSSH 7.2 or later. The error comes from old servers that only accept SHA-1 signatures.

Is PubkeyAcceptedAlgorithms +ssh-rsa safe?

It allows SHA-1 signatures for that host only. Keep it in that host's own Host block as a stopgap, and move to an Ed25519 key or a newer server.

What is the difference between ssh-rsa and rsa-sha2-256?

Both use the same RSA key. ssh-rsa signs with SHA-1, which OpenSSH stopped offering by default in 8.8, while rsa-sha2-256 and rsa-sha2-512 sign with SHA-2.

Sources

More in Error messages

All guides